Forensic Artifacts

54 results - showing 41 - 54
1 2 3
210

Artifacts

Operating System
Windows
Windows maintains connection history of wired and wireless network connections. Registry information here: https://www.dfir.training/resources/downloads/windows-registry
233

Artifacts

Operating System
Windows
Tracks files that have been opened or saved within a Windows shell dialog box. ...
463

Artifacts

Operating System
Windows
Prefetch files, like any other file in a file system, can be viewed from a digital forensic perspective to...
275
"Program execution launched on a Win10 system is tracked in the RecentApps key" - https://www.andreafortuna.org/2018/05/23/forensic-artifacts-evidences-of-program-execution-on-windows-systems/ ...
262

Artifacts

Operating System
Windows
The Windows Recycle Bin contains files that have been deleted by the user, but not yet purged from...
204

Artifacts

Operating System
Windows
"The MRU in MRU lists stands for "Most Recently Used." The MRU list is a Windows-based application that...
189

Artifacts

Operating System
Mac
pstirparo/mac4n6 https://github.com/pstirparo/mac4n6 mac4n6 https://www.mac4n6.com/...
176

Artifacts

Operating System
Mac
Safari cache URL response
422

Artifacts

Operating System
Windows
"The Microsoft Windows 8 operating system has a newly added feature to track system resource usage, specifically process and...
237 1

Artifacts

Operating System
  • Linux
  • Mac
  • Windows
Time zone information
208

Artifacts

Operating System
Mac
The new Unified Logging and Tracing System for iOS and macOS uses Activity Tracing for performance, consolidates kernel and...
219
Windows contains a number of registry entries under UserAssist that allows investigators to see what programs were recently...
267

Artifacts

Operating System
Windows
"Timeline is like a browser history, but for your whole computer; it provides a chronology which not only contains...
54 results - showing 41 - 54
1 2 3
Results per page: